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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 

1. (Currently Amended) A method for detecting a substring of interest from a 
plurality of datagrams that arrives out-of-order, comprising: 

receiving a datagram, the datagram comprising a body substring and a header 
with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to the body substring 

of said datagram to determine whether said body substring matches one of said 

substrings of interest. 

2. (Currently Amended) The method of claim 1, wherein if said preceding span and 
said succeeding span do not exist, then said body substring is inserted into said span 
set. 

3. (Currently Amended) The method of claim 1, wherein if said succeeding span 
does exist, then said body substring is joined with said succeeding span to produce a 
join span. 

4. (Original) The method of claim 3, wherein said succeeding span is replaced by 
said join span. 

5. (Currently Amended) The method of claim 1, wherein if said preceding span 
does exist, then said preceding span is joined with said body substring to produce a join 
span. 
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6. (Original) The method of claim 5, wherein said preceding span is replaced by 
said join span. 

7. (Currently Amended) The method of claim 1, wherein if said preceding span and 
said succeeding span do exist, then said preceding span is joined with said body 
substring to produce a join span. 

8. (Original) The method of claim 7, wherein said join span is joined with said 
succeeding span to produce a second join span. 

9. (Original) The method of claim 8, wherein said preceding span and said 
succeeding span are replaced by said second join span. 

10. (Currently Amended) The method of claim 1, wherein said body substring is 
forwarded, while parameters of said body substring are stored. 

11. (Currently Amended) The method of claim 10, wherein said parameters 
comprise at least one of: a state of said automaton, said index, a length of the body 
substring A and a prefix. 

12. (Original) The method of daim 1, wherein said method for detecting a substring 
of interest is performed as a network monitoring function. 

13. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an intrusion detection function. 

14. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a firewall function. 
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15. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a routing function. 

16. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a load balancing function. 

17. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an anti-virus filtering function. 

18. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an anti-spam filtering function. 

19. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a document control function. 

20. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a web content filtering function. 

21. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a virtual private network monitoring function. 

22. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a storage area network security function. 

23. (Currently Amended) The method of claim 10, further comprising: 
determining whether said forwardod body substring is subsequently dropped by a 

target machine. 

24. (Currently Amended) The method of claim 23, wherein if said forwardod body 
substring is subsequently dropped, then a connection for passing said forwarded body 
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substring is reset. 

25. (Original) The method of claim 24, wherein said connection is a TCP connection. 

26. (Currently Amended) An apparatus for detecting a substring of interest from a 
plurality of datagrams that arrives out-of-order, comprising: 

means for receiving a datagram, the datagram comprising a body substring and 
a header with an index; 

means for determining whether a preceding span exists in a span set; 
means for determining whether a succeeding span exists in said span set; and 
means for applying an automaton having a list of substrings of interest to the 

body substring of said datagram to determine whether said body substring matches one 

of said substrings of interest. 

27. (Currently Amended) The apparatus of claim 26, wherein if said preceding span 
and said succeeding span do not exist, then said body substring is inserted into said 
span set. 

28. (Currently Amended) The apparatus of claim 26, wherein if said succeeding 
span does exist, then said body substring is joined with said succeeding span to 
produce a join span. 

29. (Original) The apparatus of claim 28, wherein said succeeding span is replaced 
by said join span. 

30. (Currently Amended) The apparatus of claim 26, wherein if said preceding span 
does exist, then said preceding span is joined with said body substring to produce a join 
span. 

31 . (Original) The apparatus of claim 30, wherein said preceding span is replaced by 
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said join span. 

32. (Currently Amended) The apparatus of claim 26, wherein rf said preceding span 
and said succeeding span do exist then said preceding span is joined with said body 
substring to produce a join span. 

33. (Original) The apparatus of claim 32, wherein said join span is joined with said 
succeeding span to produoe a second join span. 

34. (Original) The apparatus of claim 33, wherein said preceding span and said 
succeeding span are replaced by said second join span. 

35. (Currently Amended) The apparatus of claim 26, wherein said body substring is 
forwarded, while parameters of said body substring are stored. 

36. (Currently Amended) The apparatus of claim 35, wherein said parameters 
comprise at least one of: a state of said automaton, said index, a length of the body 
substring A and a prefix. 

37. (Original) The apparatus of claim 26, wherein said apparatus is a network 
monitor. 

38. (Original) The apparatus of claim 26, wherein said apparatus an intrusion 
detector. 

39. (Original) The apparatus of claim 26, wherein said apparatus is a firewall. 

40. (Original) The apparatus of claim 26, wherein said apparatus is a router. 

41 . (Original) The apparatus of claim 26, wherein said apparatus is a load balancer. 
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42. (Original) The apparatus of claim 26, wherein said apparatus is an anti-virus 
filter, 

43. (Original) The apparatus of claim 26, wherein said apparatus is an anti-spam 
filter. 

44. (Original) The apparatus of claim 26, wherein said apparatus is a document 
controller. 

45. (Original) The apparatus of claim 26, wherein said apparatus is a web content 
filter. 

46. (Original) The apparatus of claim 26, wherein said apparatus is a virtual private 
network monitor. 

47. (Original) The apparatus of claim 26, wherein said apparatus is a storage area 
network security device. 

48. (Currently Amended) The apparatus of claim 35, further comprising: 

means for determining whether said forward e d body substring is subsequently 
dropped by a target machine. 

49. (Currently Amended) The apparatus of claim 48, wherein if said forwarded body 
is subsequently dropped, then a connection for passing said forward e d body is reset. 

50. (Original) The apparatus of claim 49, wherein said connection is a TCP 
connection. 

51. (Currently Amended) A computer-readable medium having stored thereon a 
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plurality of instructions, the plurality of instructions including instructions which, when 
executed by a processor, cause the processor to perform the steps of a method for 
detecting a substring of interest from a plurality of datagrams that arrives out-of-order, 
comprising of: 

receiving a datagram, the datagram comprising a body substring and a header 
with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to the body substring 

of said datagram to determine whether said body substring matches one of said 

substrings of interest. 

52. (Currently Amended) The computer-readable medium of claim 51, wherein if 
said preceding span and said succeeding span do not exist, then said body substring is 
inserted into said span set. 

53. (Currently Amended) The computer-readable medium of claim 51, wherein if 
said succeeding span does exist, then said body substring is joined with said 
succeeding span to produce a join span. 

54. (Original) The computer-readable medium of claim 53, wherein said succeeding 
span is replaced by said join span. 

55. (Currently Amended) The computer-readable medium of claim 51, wherein if 
said preceding span does exist, then said preceding span is joined with said body 
substring to produce a join span. 

56. (Original) The computer-readable medium of claim 55, wherein said preceding 
span is replaced by said join span. 
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57. (Currently Amended) The computer-readable medium of claim 51, wherein if 
said preceding span and said succeeding span do exist, then said preceding span is 
joined with said body substring to produce a join span. 

58. (Original) The computer-readable medium of claim 57, wherein said join span is 
joined with said succeeding span to produce a second join span. 

59. (Original) The computer-readable medium of claim 58, wherein said preceding 
span and said succeeding span are replaced by said second join span. 

60. (Currently Amended) The computer-readable medium of claim 51, wherein said 
body substring is forwarded, while parameters of said body substring are stored. 

61 . (Currently Amended) The computer-readable medium of claim 50, wherein said 
parameters comprise at least one of: a state of said automaton, said index, a length of 
the body substring,, and a prefix. 

62. (Currently Amended) The computer-readable medium of claim 50, further 
comprising: 

determining whether said forward e d body substring is subsequently dropped by a 
target machine. 

63. (Currently Amended) The computer-readable medium of claim 62, wherein if 
said forword o d body substring is subsequently dropped, then a connection for passing 
said forwarded body substring is reset. 

64. (Original) The computer-readable medium of claim 63, wherein said connection 
is a TCP connection. 
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